[accumulo] branch main updated: Fix unneeded audit message about denial (#1827)

[ct...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

ctubbsii pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/accumulo.git


The following commit(s) were added to refs/heads/main by this push:
     new 8908b56  Fix unneeded audit message about denial (#1827)
8908b56 is described below

commit 8908b56fa1fd36cb2bf54f4ce7dbbd579c52955f
Author: Christopher Tubbs <ct...@apache.org>
AuthorDate: Tue Dec 8 13:07:00 2020 -0500

    Fix unneeded audit message about denial (#1827)
    
    Reverse the order of permissions checks to check if the current user is
    asking about themselves. This prevents an unnecessary audit log message
    showing a denial when the user does not also have system privileges.
---
 .../apache/accumulo/server/security/SecurityOperation.java   | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
index 904002c..90cf445 100644
--- a/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
+++ b/server/base/src/main/java/org/apache/accumulo/server/security/SecurityOperation.java
@@ -227,13 +227,15 @@ public class SecurityOperation {
     }
   }
 
-  public boolean canAskAboutUser(TCredentials credentials, String user)
+  private boolean canAskAboutUser(TCredentials credentials, String user)
       throws ThriftSecurityException {
     // Authentication done in canPerformSystemActions
-    if (!(canPerformSystemActions(credentials) || credentials.getPrincipal().equals(user)))
-      throw new ThriftSecurityException(credentials.getPrincipal(),
-          SecurityErrorCode.PERMISSION_DENIED);
-    return true;
+    // check if user is current user first, to avoid unnecessary audit log if not a system user
+    // current user can always ask about themselves
+    if (credentials.getPrincipal().equals(user) || canPerformSystemActions(credentials))
+      return true;
+    throw new ThriftSecurityException(credentials.getPrincipal(),
+        SecurityErrorCode.PERMISSION_DENIED);
   }
 
   public boolean authenticateUser(TCredentials credentials, TCredentials toAuth)